Critical severity · published Sep 28, 2026
CVE-2026-101000
Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization
10.0
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NB
NBR100V2 · Netcore
1.3.240614.030928 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101000
vdb-entry
https://vuldb.com/vuln/410870
signature
https://vuldb.com/vuln/410870/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101000
third-party-advisory
https://vuldb.com/submit/919999
exploit
https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR100V2_V1.3.240614.030928%20Router/netcore_nbr100v2_uci_config_tamper.md